Authorizer
Monthly
Unauthenticated privilege escalation in the Authorizer WordPress plugin (versions up to and including 3.15.3) allows remote attackers to gain elevated privileges, potentially administrator-level, on affected WordPress sites. The vulnerability carries a CVSS 3.1 base score of 9.8 (critical) and per the vector requires no authentication or user interaction. No public exploit code has been identified at the time of analysis, but the low deployment footprint of the plugin may limit widespread exploitation.
Unauthenticated privilege escalation in the WordPress Authorizer plugin (versions 3.15.1 and earlier) lets remote attackers with no credentials elevate themselves to elevated/administrative roles, according to a CVSS 9.8 rating and CWE-266 (incorrect privilege assignment). Authorizer is an authentication/SSO plugin, so a flaw in its role-assignment logic effectively hands attackers control of the authentication gate itself. No public exploit identified at time of analysis, and the issue is reported by Patchstack rather than listed in CISA KEV.
Unauthenticated privilege escalation in the Authorizer WordPress plugin (versions up to and including 3.15.3) allows remote attackers to gain elevated privileges, potentially administrator-level, on affected WordPress sites. The vulnerability carries a CVSS 3.1 base score of 9.8 (critical) and per the vector requires no authentication or user interaction. No public exploit code has been identified at the time of analysis, but the low deployment footprint of the plugin may limit widespread exploitation.
Unauthenticated privilege escalation in the WordPress Authorizer plugin (versions 3.15.1 and earlier) lets remote attackers with no credentials elevate themselves to elevated/administrative roles, according to a CVSS 9.8 rating and CWE-266 (incorrect privilege assignment). Authorizer is an authentication/SSO plugin, so a flaw in its role-assignment logic effectively hands attackers control of the authentication gate itself. No public exploit identified at time of analysis, and the issue is reported by Patchstack rather than listed in CISA KEV.